fix: connect directly to hosts NO_PROXY excludes

The usage and Claude Status requests used HTTPS_PROXY whatever NO_PROXY
said. The usage request carries the account's OAuth token, and a user who
keeps api.anthropic.com off a proxy (for example a TLS-inspecting
corporate one) had it sent through that proxy anyway.

Both requests now connect directly when NO_PROXY (or no_proxy) lists the
host or a domain it's in: `*`, `anthropic.com`, `.anthropic.com` or
`*.anthropic.com`, optionally with `:443`. HTTPS_PROXY itself is still
read in uppercase only, as documented.

Author: eric-engberg

README.md

@@ -364,7 +364,7 @@ The interactive configuration tool provides a terminal UI where you can:
 > export CLAUDE_CONFIG_DIR=/custom/path/to/.claude
 > ```
 
-> 🌐 **Usage API proxy:** Usage widgets honor the uppercase `HTTPS_PROXY` environment variable for their direct API call to Anthropic.
+> 🌐 **Usage API proxy:** Usage widgets honor the uppercase `HTTPS_PROXY` environment variable for their direct API call to Anthropic, and connect directly when `NO_PROXY` lists `api.anthropic.com` or a domain it's in.
 
 > 🪟 **Windows Support:** PowerShell examples, installation notes, fonts, troubleshooting, WSL, and Windows Terminal configuration are in [docs/WINDOWS.md](docs/WINDOWS.md).
 

docs/DEVELOPMENT.md

@@ -78,7 +78,7 @@ Usage-lock deadlines more than 24 hours ahead are treated as poisoned and ignore
 - **Transcript-backed widgets** stream the active JSONL transcript once per render through `getTranscriptAnalysis()`, collecting token, duration, speed, compaction, thinking-effort, and session-name data in one pass without materializing the whole file. Referenced subagent transcripts are streamed separately only when speed metrics include subagents.
 - **Block Timer** caches a detected block until its five-hour window expires. When a full scan finds no active block, that empty result is cached for one minute so subsequent repaints do not repeatedly walk and read the entire transcript history.
 - **Cache Timer** reads the transcript tail directly on every render. It expands the read backward when a trailing JSONL record exceeds the initial window, ignores sidechain and synthetic API-error rows, and anchors the countdown only on assistant requests with cache activity. It does not create a separate cache file.
-- **Claude Status** reads `status.claude.com` through HTTPS, honors `HTTPS_PROXY`, and caches successful responses for five minutes. It requests incident data only when at least one configured Claude Status widget enables history, applies a 30-second backoff after failed fetches, and serves a usable stale cache when available.
+- **Claude Status** reads `status.claude.com` through HTTPS, honors `HTTPS_PROXY` unless `NO_PROXY` excludes the host, and caches successful responses for five minutes. It requests incident data only when at least one configured Claude Status widget enables history, applies a 30-second backoff after failed fetches, and serves a usable stale cache when available.
 - **Local Git widgets** cache command results in memory and under `~/.cache/ccstatusline/git-cache`. Cache misses invoke Git with a five-second timeout; failures, including timeouts, are cached as `null`. Persistent writes use one stable `.tmp` path per cache file and attempt best-effort cleanup on failure, bounding orphaned files when Windows virus scanners or sync clients temporarily hold a handle.
 - **Git PR and Git CI Status** render from the versioned disk cache under `~/.cache/ccstatusline/git-review`. Missing or stale entries are refreshed in a detached helper so network-bound `gh` or `glab` calls do not block rendering. Git CI Status adds GitHub's `statusCheckRollup`; if the authenticated `gh` token cannot read checks, the refresh retries with PR metadata only so Git PR still works.
 - **Usage widgets** merge Claude Code's stdin `rate_limits` with `/api/oauth/usage` only for fields required by the active widgets. Session and aggregate weekly fields prefer the flat API buckets and fall back to `limits[]`; per-model weekly fields prefer `weekly_scoped` entries. A model-scoped entry reporting 0% without `resets_at` is valid zero usage, while unscoped empty placeholders remain filtered out. `WEEKLY_MODEL_USAGE_BUCKETS` in `src/utils/usage-types.ts` is the shared registry for Sonnet, Opus, and Fable widget wiring, field requirements, reset fields, and scoped-limit matching. Session and weekly percentage widgets delegate rendering and editor behavior to `src/widgets/shared/usage-percent-widget.ts`; the Fable label is `Weekly Fable:`.

src/utils/__tests__/claude-service-status.test.ts

@@ -27,24 +27,37 @@ type StatusPageRequestFn = NonNullable<Parameters<typeof __testing.fetchStatusPa
 const HOUR_MS = 60 * 60 * 1000;
 const NOW = Date.parse('2026-08-15T12:00:00Z');
 
-// Tests set HTTPS_PROXY themselves; the environment running the suite must not leak in.
+// Tests set HTTPS_PROXY and NO_PROXY themselves; the environment running the
+// suite must not leak in.
 function isolateHttpsProxyEnv(): void {
-    let original: string | undefined;
+    let originalProxy: string | undefined;
+    let originalNoProxy: string | undefined;
+    let originalLowercaseNoProxy: string | undefined;
 
     beforeEach(() => {
-        original = process.env.HTTPS_PROXY;
+        originalProxy = process.env.HTTPS_PROXY;
+        originalNoProxy = process.env.NO_PROXY;
+        originalLowercaseNoProxy = process.env.no_proxy;
         delete process.env.HTTPS_PROXY;
+        delete process.env.NO_PROXY;
+        delete process.env.no_proxy;
     });
 
     afterEach(() => {
-        if (original === undefined) {
-            delete process.env.HTTPS_PROXY;
-        } else {
-            process.env.HTTPS_PROXY = original;
-        }
+        restoreEnv('HTTPS_PROXY', originalProxy);
+        restoreEnv('NO_PROXY', originalNoProxy);
+        restoreEnv('no_proxy', originalLowercaseNoProxy);
     });
 }
 
+function restoreEnv(name: 'HTTPS_PROXY' | 'NO_PROXY' | 'no_proxy', value: string | undefined): void {
+    if (value === undefined) {
+        Reflect.deleteProperty(process.env, name);
+    } else {
+        process.env[name] = value;
+    }
+}
+
 function incident(impact: ClaudeIncidentWindow['impact'], startHoursAgo: number, endHoursAgo: number | null): ClaudeIncidentWindow {
     return {
         impact,
@@ -279,6 +292,15 @@ describe('status page response handling', () => {
         expect((agent as HttpsProxyAgent<string>).proxy.href).toBe('http://proxy.example:8080/');
     });
 
+    it('connects directly when NO_PROXY lists status.claude.com', async () => {
+        process.env.HTTPS_PROXY = 'http://proxy.example:8080';
+        process.env.NO_PROXY = 'localhost,claude.com';
+        const requestFn = vi.fn(respondingRequest(200, ['{}']));
+
+        await expect(__testing.fetchStatusPagePath('/test', requestFn)).resolves.toBe('{}');
+        expect(requestFn.mock.calls[0]?.[0]).not.toHaveProperty('agent');
+    });
+
     it('ignores a whitespace-only HTTPS_PROXY', async () => {
         process.env.HTTPS_PROXY = '   ';
         const requestFn = vi.fn(respondingRequest(200, ['{}']));

src/utils/__tests__/no-proxy.test.ts

@@ -0,0 +1,44 @@
+import {
+    describe,
+    expect,
+    it
+} from 'vitest';
+
+import { isExcludedFromProxy } from '../no-proxy';
+
+describe('isExcludedFromProxy', () => {
+    it.each([
+        ['*'],
+        ['api.anthropic.com'],
+        ['anthropic.com'],
+        ['.anthropic.com'],
+        ['*.anthropic.com'],
+        ['API.Anthropic.COM'],
+        ['api.anthropic.com:443'],
+        ['localhost, api.anthropic.com'],
+        ['localhost,,anthropic.com'],
+        ['localhost anthropic.com']
+    ])('excludes api.anthropic.com for NO_PROXY=%j', (noProxy) => {
+        expect(isExcludedFromProxy('api.anthropic.com', { NO_PROXY: noProxy })).toBe(true);
+    });
+
+    it.each([
+        [''],
+        ['localhost'],
+        ['example.com'],
+        ['pi.anthropic.com'],
+        ['notanthropic.com'],
+        ['api.anthropic.com:8443'],
+        ['.']
+    ])('keeps api.anthropic.com on the proxy for NO_PROXY=%j', (noProxy) => {
+        expect(isExcludedFromProxy('api.anthropic.com', { NO_PROXY: noProxy })).toBe(false);
+    });
+
+    it('reads the lowercase no_proxy too', () => {
+        expect(isExcludedFromProxy('status.claude.com', { no_proxy: 'claude.com' })).toBe(true);
+    });
+
+    it('excludes nothing when neither variable is set', () => {
+        expect(isExcludedFromProxy('status.claude.com', {})).toBe(false);
+    });
+});

src/utils/__tests__/usage-fetch.test.ts

@@ -44,6 +44,7 @@ interface ProbeOptions {
     httpsProxy?: string;
     lockWrittenDuringRequest?: string;
     lowercaseHttpsProxy?: string;
+    noProxy?: string;
     mode?: 'error' | 'status' | 'success' | 'unexpected';
     nowMs: number;
     pathDir?: string;
@@ -207,7 +208,8 @@ process.stdout.write(JSON.stringify({
             const normalizedKey = key.toUpperCase();
             return normalizedKey !== 'CLAUDE_CONFIG_DIR'
                 && normalizedKey !== 'CLAUDE_SECURESTORAGE_CONFIG_DIR'
-                && normalizedKey !== 'HTTPS_PROXY';
+                && normalizedKey !== 'HTTPS_PROXY'
+                && normalizedKey !== 'NO_PROXY';
         }));
 
         Object.assign(env, {
@@ -241,6 +243,10 @@ process.stdout.write(JSON.stringify({
             env.https_proxy = options.lowercaseHttpsProxy;
         }
 
+        if (options.noProxy !== undefined) {
+            env.NO_PROXY = options.noProxy;
+        }
+
         const output = realExecFileSync(process.execPath, [probeScriptPath], {
             encoding: 'utf8',
             env
@@ -430,6 +436,34 @@ describe('fetchUsageData error handling', () => {
         }
     });
 
+    // The request carries the account's bearer token, so a host the user kept
+    // off the proxy must stay off it
+    it('connects directly when NO_PROXY lists api.anthropic.com', () => {
+        const harness = createProbeHarness();
+
+        try {
+            const noProxyHome = harness.createTokenHome('no-proxy');
+
+            const result = harness.runProbe({
+                claudeConfigDir: noProxyHome.claudeConfig,
+                home: noProxyHome.home,
+                httpsProxy: 'http://proxy.local:8080',
+                noProxy: 'localhost,.anthropic.com',
+                mode: 'success',
+                nowMs,
+                pathDir: noProxyHome.bin,
+                responseBody: successResponseBody
+            });
+
+            expect(result.first).toMatchObject({ sessionUsage: 42, weeklyUsage: 17 });
+            expect(result.requestCount).toBe(1);
+            expect(result.proxyAgentConfigured).toBe(false);
+            expect(result.requestHost).toBe('api.anthropic.com');
+        } finally {
+            harness.cleanup();
+        }
+    });
+
     it('preserves root errors within a process and keeps existing proxy and cache behavior', () => {
         const harness = createProbeHarness();
 

src/utils/claude-service-status.ts

@@ -9,6 +9,7 @@ import type { ColorLevelString } from '../types/ColorLevel';
 import type { WidgetItem } from '../types/Widget';
 
 import { getColorAnsiCode } from './colors';
+import { isExcludedFromProxy } from './no-proxy';
 
 // Cache configuration mirrors usage-fetch.ts: a short-lived disk cache shared
 // across statusline invocations, plus a failure lock so an unreachable status
@@ -259,7 +260,7 @@ function clearFailureLock(): void {
 
 function getStatusPageProxyUrl(): string | null {
     const proxyUrl = process.env.HTTPS_PROXY?.trim();
-    return proxyUrl?.length ? proxyUrl : null;
+    return proxyUrl?.length && !isExcludedFromProxy(STATUS_HOST) ? proxyUrl : null;
 }
 
 interface StatusPageResponse {

src/utils/no-proxy.ts

@@ -0,0 +1,30 @@
+/**
+ * Whether NO_PROXY (or no_proxy) keeps HTTPS requests to `host` off the proxy:
+ * `*`, the host itself, or a domain it's in (`anthropic.com`, `.anthropic.com`
+ * or `*.anthropic.com`), each optionally with `:443`. Both spellings are read,
+ * since honoring an exclusion only ever sends less through the proxy.
+ */
+export function isExcludedFromProxy(host: string, env: NodeJS.ProcessEnv = process.env): boolean {
+    const target = host.toLowerCase();
+    const entries = [env.NO_PROXY, env.no_proxy]
+        .filter((value): value is string => typeof value === 'string')
+        .flatMap(value => value.split(/[\s,]+/));
+
+    return entries.some((rawEntry) => {
+        let entry = rawEntry.toLowerCase();
+        const portStart = entry.lastIndexOf(':');
+        if (portStart !== -1) {
+            if (entry.slice(portStart + 1) !== '443') {
+                return false;
+            }
+            entry = entry.slice(0, portStart);
+        }
+
+        if (entry === '*') {
+            return true;
+        }
+
+        const domain = entry.replace(/^\*?\./, '');
+        return domain !== '' && (target === domain || target.endsWith(`.${domain}`));
+    });
+}

src/utils/usage-fetch.ts

@@ -8,6 +8,7 @@ import * as path from 'node:path';
 import { z } from 'zod';
 
 import { getClaudeConfigDir } from './claude-settings';
+import { isExcludedFromProxy } from './no-proxy';
 import type {
     UsageData,
     UsageDataField,
@@ -765,7 +766,7 @@ const USAGE_API_TIMEOUT_MS = 5000;
 
 function getUsageApiProxyUrl(): string | null {
     const proxyUrl = process.env.HTTPS_PROXY?.trim();
-    if (proxyUrl === '') {
+    if (proxyUrl === '' || isExcludedFromProxy(USAGE_API_HOST)) {
         return null;
     }